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DESIGN AND EVALUATION OF A SENSOR FAIL-OPERATIONAL CONTROL 
SYSTEM FOR A DIGITALLY CONTROLLED TURBOFAN ENGINE 
by Frank J. Hrach, DaleJ. Arpasi, and William M. Bruton 
Lewis Research Center 

SUMMARY 

A sensor fail- operational digital control system for the TF30-P-3 afterburning 
turbofan engine was designed and evaluated. The system has the capability of storing 
(learning) engine operational data when the engine measurements are valid. Four en- 
gine measurements, corrected to compressor face conditions, are tested for catastroph- 
ic sensor failure. Any valid measurements are replaced with estimates obtained from 
the valid measurements and tables of operational data previously stored in the computer 
memory. Data are stored for the engine bleed settings and for both steady-state and 
acceleration dynamic conditions. The compressor face measurements are tested for 
any unrealistic variations because the procedure is based upon these signals being cor- 
rect. 

The sensor fail- operational system consists of (1) a digitalization of the standard 
bill-of- materials (BOM) control for the TF30-P-3 engine and (2) a separate sensor fail- 
operational digital computer program written especially for the BOM control. It is not 
a completely new control system designed specifically to incorporate fail- operational 
requirements. 

The system was evaluated on a real-time, nonlinear, hybrid-computer simulation 
of the TF30-P-3 turbofan engine. Flight conditions examined were sea-level static con- 
dition, a typical cruise condition, and several extreme flight conditions. 

The study indicates that acceptable control over the range of flight conditions ex- 
amined is possible with certain levels of sensor failure. For nonafterburning operation, 
acceptable control is possib).e even after three of the four engine sensors have failed. 

For afterburning operation, adequate control can be achieved with no more than a single 
failure and then only if a modest rate limit is imposed upon engine acceleration. Ac- 
ceptable control means that none of the engine operating limits have been exceeded and 
that nearly the same engine thrust performance is achieved. 

This work indicates that it is possible to design a sensor fail-operational control 
system for an aircraft engine which will improve the engine's reliability. 


INTRODUCTION 


The state of the art of digital computers qualified for aircraft use has advanced to 
the point where they are now being applied to engine control. A supervisory digital 
control system is already in use on the advanced military FlOO-PW-lOO engine. For 
aircraft engine control, as in other control applications, digital control offers some at- 
tractive potential benefits. They include lower initial cost; lower maintenance costs; 
and the ability to implement more accurate control, resulting in improved engine per- 
formance. Also digital control offers the capability of easily changing a control mode 
by simply reprogramming the computer or of modifying the existing control mode during 
operation by a higher-level adaptive control loop. New engine designs are becoming 
more complex and require more complex control; and the interaction between airframe, 
inlet, and propulsion system is becoming more critical for newer aircraft designs. 
Future control systems must have the capability of providing these complex control 
functions and of integrating the control of interacting components. A digital control 
system has this capability. 

For digital control to be viable, steps must be taken to ensure that the reliability of 
full- authority, flight-qualified, digital propulsion control systems approaches that of the 
well-proved hydromechanical systems presently used on aircraft engines. This applies 
to the entire system, which includes sensors, effectors, and the digital computer. Re- 
liability can be improved, of course, by means of redundancy for all the elements of the 
control system. In the digital computer, self-testing and redundancy can be incorpo- 
rated relatively easily. However, using redundant sensors and effectors may not be 
practical. An alternative approach for handling failures of these elements is fail- 
operational control. Essentially, this approach involves using a model of the system to 
provide information necessary for control in the event of a failure. (Of course, this ap- 
proach can also be used in conjunction with redundancy. ) 

This report is concerned with sensor failures only and describes the design of a 
control system which would continue to function adec[uately even though some engine 
measurements normally needed for control were not available. A control system of 
this t5q)e is herein referred to as a sensor fail-operational control system. The goal of 
this and any fail-operational control system is to achieve system performance within ac- 
ceptable limits for as many failures as possible. 

Some theoretical work has been done in the field of fail- operational control. A 
rather extensive treatment is contained in reference 1. That research develops methods 
of self-reorganization which can provide a complex linear dynamic system with the abil- 
ity to restructure itself to compensate for failures in the effectors and sensors and for 
changes in the linear dynamics. The approach taken is to identify the failure or change 
in the system and use that information to restructure a feedback control loop to maintain 
closed- loop stability if possible. 
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A different approach is taken in reference 2, which is concerned only with sensor 
failures in an aircraft flight control system. The innovations from a bank of Kalman 
filters are used to detect sensor failures by means of M-ary h 5 ^othesis testing. The 
detection logic then selects the optimal state estimate from the bank of Kalman filters. 
Capabilities of the method are demonstrated by a real-time linear simulation of the sys- 
tem with noisy sensors. 

The design of a sensor fail- operational control system for a two-spool turbofan en- 
gine is presented in reference 3. Ten estimates of each critical engine variable are 
made by using sensor measurements and a multivariable linearized engine model. The 
differences between estimates provides the basis for identifying any sensors that have 
failed. A weighted average of valid estimates is used for control. Corrected engine 
measurements were used, which permitted the same model to be used for all flight con- 
ditions. This system was checked out on a nonlinear digital simulation of the engine. 

In reference 4 a sensor fail-operational control system was designed and tested on 
an actual turbojet engine in a sea- level test stand. The relation between two sensor 
measurements was stored in a digital computer during normal engine operation. When 
either sensor failed, an estimate obtained from the valid sensor measurement and the 
stored relation was used to successfully control the engine. The engine tested was a 
single-spool J85 turbojet. A limitation of that work was that only a single operating 
condition (sea-level static) could be examined. 

The present work is an extension of that reported in reference 4. In the present 
study, a wide range of flight conditions is investigated, rather than a single flight con- 
dition. Corrected engine variables are used to handle the wide variations in the engine 
measurements. The present work is done for a more advanced engine, a two-spool 
turbofan engine, the TF30-P-3. Also, four engine variables are tested, not two as was 
done in reference 4. Instead of testing the sensor fail-operational system on an actual 
engine, a real-time nonlinear hybrid computer simulation was used. It is felt that the 
engine simulation models the engine with sufficient accuracy to permit evaluation of the 
control system. With an engine simulation, a wide range of flight conditions can be ex- 
amined relatively easily without the need for an elaborate test facility. 

As was done in reference 4, relations between the engine measurements are stored 
in the digital computer during normal operation. Now, however, the measurements are 
in corrected variable form. Estimates for any erroneous measurements are made in a 
manner similar to that of reference 4. With this approach, the sensor fail-operational 
system can be thought of as storing an algebraic model of the engine under normal con- 
trol. It assumes that unique relations exist between the measured engine variables. 

This is true for a particular engine geometry and operating condition. If the rela- 
tions between the measurements change significantly with configuration (such as bleed 
settings) and dynamic condition (steady state or transient), it is necessary to store data 
for each case. This task is well suited for a digital computer because of its large mem- 
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ory capacity. Here actual nonlinear functions relating the corrected engine measure- 
ments are stored, whereas in reference 3 only linear approximations of the relations are 
made. 

The report first describes the system used in the evaluation of the sensor fail- 
operational system that was developed. It then discusses the concept in general terms. 
Following this, the application of the concept to the TF30-P-3 engine is described. 
Finally, the results obtained with the sensor fail- operational system are presented. 


TF30-P-3 ENGINE AND CONTROL 
Engine 

A schematic representation of the TF30-P-3 engine with station designations is pre- 
sented in figure 1. The TF30-P-3 engine is a two-spool, mixed- flow, afterburning turbo- 
fan engine. A three-stage, axial-flow fan is mounted on the same shaft with a six-stage, 
axial-flow, low-pressure compressor driven by a three-stage, low-pressure turbine. A 
seven-stage, axial-flow, high-pressure compressor is driven by a single-stage, air- 
cooled, high-pressure turbine. The engine has a hydraulically actuated, variable-area 
exhaust nozzle which changes area only during afterburning. The afterburner fuel spray- 
rings are arranged in five separate afterburning zones. There are two compressor 
bleeds; a seventh-stage bleed on the low-pressure compressor and a twelfth-stage bleed 
on the high-pressure compressor. 

The variables used for control of the TF30- P-3 are listed in table 1 under the cat- 
egories of command input, flight condition, measured compressor face, measured en- 
gine, manipulated, and controlled variables. Reference 5 includes a rather detailed 
description of the operation of the control system. In the present report, it is sufficient 
to point out that the main fuel flow is determined by two measured engine variables; the 
high-pressure-rotor speed and the high-pressure-compressor discharge static pressure 
(which is approximately equal to the combustor pressure). The afterburner fuel flow and 
the exhaust nozzle area are determined by three measured engine variables; high- 
pressure-rotor speed, high-pressure-compressor discharge static pressure, and nozzle 
total pressure. The seventh-stage-bleed position is determined by the inlet Mach num- 
ber; the twelfth-stage-bleed position is a function of the low-pressure-compressor dis- 
charge static pressure and the compressor face total pressure. 

The operating limits for the engine which determine the range of the compressor 
face variables are presented in figure 2. These limits are based upon standard-day con- 
ditions and a MIL-E-5008B inlet pressure recovery. The extreme values of compressor 
face total temperature and pressure are noted on the figure. Note the more than 2:1 
variation in total temperature and the 30:1 variation in total pressure. (Symbols are de- 
fined in the appendix. ) 
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Engine and Inlet Simulation 


The TF30-P-3 engine with a standard inlet has been simulated by using the Lewis 
Research Center’s analog and hybrid computing facility. The simulation, which oper- 
ates in real time, is described in reference 6. It consists of a fully dynamic represen- 
tation of the engine but only a steady- state representation of an inlet with a standard 
MlL-E-5008 B pressure recovery. 

The simulation is done on the Electronic Associates, Inc. (EAI) Model 690 Hybrid 
Computing System, which consists of an EAI 640 Digital Computer, an EAI 693 Hybrid 
Interface Unit, and an EAI 680 Analog Computer. Two EAI 231-R Analog Computers 
are also used. Figure 3 illustrates the split of the computational load among the various 
computers. The split is based on the computing equipment complement of each console 
and a desire to minimize trunking. The bulk of the calculations are performed on the 
EAI 680 and the two 231-R Analog Computers. The analog computers perform all the 
operations characteristic of analog machines (i. e. , summing, integration with respect to 
time, multiplication, attenuation, univariate function generation, etc.). The use of pe- 
ripheral equipment such as x-y plotters and strip-chart recorders allows continuous user 
monitoring of computed variables. All the required analog computers are tied togeth- 
er by means of a Centralized Trunk System to allow the transmittal of information be- 
tween analog consoles. 

The 640 Digital Computer is used primarily to perform the bivariate function gen- 
eration associated with fan, compressor, and turbine performance. The digital comput- 
er also provides teletypewriter output listings of selected engine variables. In order to 
minimize the core storage requirements and digital cycle time, scaled-fraction variables 
and arithmetic routines are used in the digital program. Scaled-fraction variables are 
limited to values between ±1. The use of scaled fractions necessitates the scaling of 
digital variables in the same manner as the analog variables are scaled. 

The digital portion of the simulation requires approximately 10 000 words of core 
storage. The resulting digital sampling interval (with steady analog inputs) is about 
4. 65 milliseconds, which allows real-time simulation of engine dynamics. The analog 
portion of the TF30-P-3 hybrid simulation performs all the required computations ex- 
cept the bivariate function generation previously discussed. The analog computational 
load is split between the 680 Analog Computer and two 231-R Analog Computers. Ap- 
proximately 185 amplifiers and 85 multipliers are required to perform the analog cal- 
culations. The 680 Analog Computer also serves as the interface between the engine 
simulation and the digital engine controller. The manipulated variables for the engine 
simulation are provided by an independent digital computer representation of the TF30- 
P-3 hydromechanical control system described in the next section. 
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Digital Engine Control 


A digitalization of the TF30-P-3 bill-of- materials (BOM) control has been devel- 
oped for use on the Lewis Research Center' s digital computer control facility for on-line 
control of airbreathing propulsion systems. This digital computer program has been 
used successfully to control the engine and inlet simulation just described. A detailed 
description of the program and the results obtained with it are given in reference 5. The 
digital computer program requires only about 5000 words of the 16 000-word memory 
available in the facility. Calculation time is as short as 3. 2 milliseconds. The matter 
of necessary sampling time for acceptable control is also investigated in reference 5 
and in an earlier report, reference 7. Both these studies indicate that a sampling inter- 
val time as long as 50 milliseconds is acceptable. A value of 25 milliseconds was sel- 
ected for this study. Accurately modeling the hydromechanical control requires that the 
effect of dynamics for fuel lines and control actuators be taken into accoimt. Two small 
analog computers are used to model the dynamic relations of these components. 

The unused digital control computer memory and the available calculation time are 
used for the sensor fail-operational computer program. This is described in the section 
IMPLEMENTATION ON THE TF30-P-3 ENGINE. 

The Lewis Research Center's digital computer control facility, which is described 
in reference 8, was also used in the earlier sensor fail- operational work conducted at 
Lewis (ref. 4). The heart of the system is a Systems Engineering Laboratories (SEL) 
Model 810B process control computer with a basic 16 000-word memory. 

Table II (extracted from ref. 8) lists some of the digital system capabilities. The 
computer and its associated equipment are not flight- qualified hardware. However, 
characteristics such as cycle time, memory, and interrupt structure are typical of what 
may exist in some future flight system. 

A diagram of the complete system used in the sensor fail- operational study is pre- 
sented in figure 4. The variables transferred to the system and between the components 
are indicated on the diagram. 


SENSOR FAIL- OPERATIONAL CONTROL 
Conceptual Basis 

Sensor fail- operational control is based on the fact that for a given engine geometry 
and dynamic condition the same relations exist between certain corrected engine vari- 
ables over a wide range of power settings and flight conditions. An example of these 
relations is an operating line on a corrected- variable compressor map, shown sche- 
matically in figure 5. As indicated in the figure, throttle setting determines a point on 
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the operating line. At that point, a unique relation exists between the variables on the 
map; pressure ratio, corrected engine speed, and corrected airflow. If one variable, 
for example, pressure ratio, is unavailable, it can be estimated from either of the other 
two variables at the operating point - from corrected speed, for example. This estima- 
tion can be carried out on a digital computer by first storing the relation between these 
two variables along the operating line. 

In the compressor map example, a change in engine geometry, such as a bleed 
opening, causes a shift of the operating line. It is necessary therefore to store ad- 
ditional relations between the variables for those engine configurations for which the 
change in the operating line is significant. Also, the locus of operating points during 
acceleration of the engine shifts toward the surge line. Data for both steady state and 
acceleration may have to be stored if the shift is large. 

The measured engine variables are corrected by the compressor face conditions of 
total temperature and pressure. They are corrected as indicated in reference 9, rather 
than being made dimensionless. 


Incorporation in an Engine Control System 

The sensor fail-operational concept might be made part of an engine control sys- 
tem, as illustrated in figure 6, In this figure, a conventional control system is com- 
pared with a system having sensor fail- operational capability, herein called a sensor 
fail- operational control system. In the conventional control system, the command in- 
put, flight condition, measured compressor face, and measured engine variables go 
directly to the engine control. In a possible sensor fail- operational control system, all 
these variables except the flight condition variables go to a separate digital program 
which performs the following functions: 

(1) Stores the corrected engine measurements during normal operation for all 
significant engine configurations and dynamic conditions 

(2) After sufficient data are stored, continuously checks the engine measurements 
to determine whether any are invalid because of a failed sensor 

(3) In case of a failure, provides an estimate for the invalid measurement based on 
the valid measurements and the data stored in the computer for the particular 
engine geometry and dynamic condition 

The system may have a learning capability; that is, data are stored as the engine 
is operated. This is not an essential feature. Nominal engine operational data could be 
stored in the computer before startup. Another possibility would be to store the nominal 
data before startup and to modify these data either by replacing the nominal data with the 
current data or by averaging the current data with previous data. 
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A sensor failure is defined as a failure in the transducer itself, in the device which 
converts the measurement to digital form (which can be part of the transducer), or in 
the link between the transducer and the computer. Detection of a sensor failure can be 
a difficult task. Some types, such as a catastrophic failure (hard failure), which is 
characterized by a sudden change to some unrealistic value, are easy to detect. Others, 
such as a slow change (soft failure) to some value still within the allowable operating 
range, ^e difficult to detect. 

In estimating the value of a particular failed measured variable, some of the valid 
measurements are better to use than others because some variables are more closely 
coupled together. When possible, it is better to use a closely coupled variable to esti- 
mate a value for an invalid measurement. 


IMPLEMENTATION ON THE TF30-P-3 ENGINE 

A sensor fail-operational digital computer program was written for the TF30-P-3 
engine. Features of this program are described in this section. 


Learning Procedure 

Engine operational data were stored (or learned) as the simulated engine was oper- 
ated over its complete range. The procedure consisted of varjdng power lever angle 
from idle to full afterburning for all three possible bleed settings. Bleeds were oper- 
ated manually for this initial learning. The variations were at two rates: slow, to ap- 
proximate a series of steady-state operating points; and rapid (throttle slam), to obtain 
acceleration data. 

Data were not stored during deceleration. It was found that separate data for en- 
gine deceleration were not needed; the steady-state data were adequate for estimating 
values during deceleration. 

This procedure may not be practical for the actual engine. As was pointed out pre- 
viously, it might be better to store nominal engine operational data in the computer be- 
fore engine startup. This would eliminate the necessity of extensive operation of the 

\ 

engine before flight. The matter of initially getting the data in the computer is an op- 
erational problem and is considered to be beyond the scope of this report. 

The tables of stored measured engine variables are listed in table HI. The relations 
between each pair of the six possible pairs formed from four corrected measured engine 
variables are stored. Each table is divided into three parts, the data occupying each 
part corresponding to one of the three possible bleed setting combinations. Each sep- 
arate part was allocated 64 words of core storage. 
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The data are stored as follows: The range of each independent variable in each table 
was first subdivided into equal increments. The increment end values are called sub- 
division points. The computer cycles and samples values of the variables to be stored. 
When a measured value of an independent variable is within 20 percent of one of the 
subdivision points, the associated value of the dependent variable is taken as the value 
corresponding to that subdivision point. For each subdivision point, values are simply 
averaged until 32 samples have been taken; thereafter, a weighted average is taken. 

The current stored value is weighted by a factor of 31/32, and the present sampled val- 
ue by a factor of 1/32. This feature of updating the stored data allows for the slow deg- 
radation of engine performance but unfortunately also includes the effect of slow degra- 
dation of the sensors, an effect it would be desirable to eliminate. 

In order to fill any locations (subdivision points) for which no measurements have 
been made, a linear interpolation scheme is used. In addition, the data are extrapolated 
beyond the upper and lower values corresponding to the upper and lower values of power 
lever angle. This is done by extending straight-line segments beyond the learned data. 
The slopes of the line segments are determined from the maximum and minimum points. 

Failure Tests 

During the learning phase of operation, failure tests of only the command input and 
the compressor face variables are made. No failure tests of engine measurements are 
made until operational data for all bleed settings and both dynamic conditions have been 
learned over the complete range of power settings, (This is important only if the data 
are learned during operation and not if nominal engine data are initially stored in the 
computer. ) The variables tested are the command input variable (power lever angle), 
the measured compressor face variables (total temperature and total pressure), and the 
measured engine variables (corrected high-pressure- rotor speed, corrected high- 
pressure-compressor discharge static pressure, corrected low-pressure-compressor 
discharge static pressure, corrected nozzle total pressure, and nozzle area). The 
flight condition variables (Mach number and ambient pressure) come from the inlet con- 
trol and are assumed to be always correct; they are therefore not tested. 

The commanded value of power lever angle is directed to the sensor fail- operational 
computer program because under some conditions the program substitutes a different 
value than commanded. Although steps will be taken to assure the reliability of this in- 
put variable, a test is made to further assure its accuracy. The test consists of simply 
determining whether the variable is within its permissible range of values. 

The measured compressor face variables (total temperature and total pressure) are 
monitored for any changes which would be physically impossible under normal operation. 
The changes associated with changing flight conditions occur rather slowly and are not 
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interpreted as a failure. There are fluctuations in these variables when the afterburner 
is lit. Any flight system must allow these changes to pass through the failure detection 
logic. 

The measured engine variables, with the exception of nozzle area, are tested to de- 
termine whether they are within their range of permissible values, that is, the maximum 
and minimum values the corrected variables can assume. This particular test detects 
only catastrophic failures (hard failures). The nozzle area is tested to ensure that it is 
properly following the nozzle area command. This test can be made because the digital 
control calculates a nozzle area from the command and a dynamic model of the nozzle 
(ref. 5). If the difference between the actual area and the calculated area exceeds a 
specified value, the nozzle area sensor is assumed to have failed. 


Action under Failure 

When a sensor failure has been detected, the action taken depends, of course, on the 
type of failure. One common action under any type of failure is that further learning 
ceases. 

If the command input (power lever angle) is in error, the computer program gen- 
erates a command which shuts down the engine. Nothing else can be done. 

Since the compressor face variables are used to correct the engine measurements, 
an accurate test of and estimate for engine measurements cannot be made if a compres- 
sor face sensor has failed. Therefore, for this type of failure, the engine is shut down 
by a command from the computer program. Because^ the importance of having valid 
compressor face measurements, these sensors should probably be redundant. 

In the case of a nozzle area sensor failure, the invalid measurement is replaced by 
the calculated value used in the detection of the failure. 

For the case of a single failure of one of the four remaining engine sensors, an es- 
timate is made from the three valid measurements and the tables of stored data. For 
each valid measurement, an estimate is obtained from the appropriate table (for the 
particular bleed condition and engine dsmamic state) relating the two variables by linear 
interpolation between the stored values. An average of the three estimates is taken, 
and the resultant value is used by the engine control. In this case and in those for which 
more than one estimate is available, the estimates are weighted equally. No work was 
done on examining the effect of unecpial weighting. In the case of two failures, the ac- 
tion is similar except this time only two values are averaged to obtain an estimate for 
each of the two invalid measurements. Tn the casp nf thrpp failures, an estimate for 
each of the three invalid measurements is made from the single remaining valid meas- 
urement. In the highly unlikely case of four failures, the computer program commands 
the engine to shut down. 
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Bleed Control under Failure 


Because the bleeds are controlled by measured variables and the estimates for in- 
valid measurements are a function of the bleed position, it is important to assure that 
the bleeds operate properly under failure. 

The seventh-stage bleed is controlled by the Mach number signal only, which is as- 
sumed to be always correct. Therefore, the seventh- stage- bleed condition will always 
be correct under all allowable failures. 

The twelfth-stage bleed is controlled by the low-pressure-compressor discharge 
static pressure and the compressor face total pressure. If the low- pressure- 
compressor-discharge-static-pressure sensor should fail, a value is estimated for it 
by the procedure described previously. If the estimated value is close enough to the 
actual value, the bleed should operate normally. If the compressor-face-total-pressure 
sensor should fail, the engine is shut down as previously stated. 


Computer Program Outline 

A flow chart of the sensor fail-operational digital computer program is presented 
in figure 7. The numbers on the following outline correspond to the numbers on the 
flow chart: 

(1) The engine measurements are corrected. The three pressures are divided by 

6, the ratio of compressor face total pressure to standard sea- level pressure; the high- 
pressure- rotor speed is divided by e being the ratio of the compressor face total 
temperature to standard sea- level temperature. 

(2) The power lever angle is tested. If it is invalid, the engine is shut down. 

(3) The compressor face total pressure and total temperature sensors are tested. 

If either has failed, the engine is shut down. 

(4) A test is performed to determine whether sufficient data have been learned. If 
not, data for the current operating point are learned and the program is exited. 

(5) If sufficient data have been learned, the engine measurements are tested. 

(6) If there are no sensor failures, data for the current operating point are learned 
and the program is exited. 

(7) If all the engine sensors (not including nozzle area) have failed, the engine is 
shut down. 

(8) Values for the invalid engine measurements are estimated from the valid meas- 
urements and the tables of stored data. 
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RESULTS AND DISCUSSION 


Comparison of Measvired Engine Variable Relations 

The method of estimating values for invalid engine measurements is based upon the 
assumption that the relations between the corrected measured engine variables remain 
nearly the same at all flight conditions, hi order to determine if this is indeed so, data 
were collected at the five flight conditions indicated by the circular symbols in figure 2. 
It would have been preferable to examine the points of extreme compressor face total 
pressure and temperature indicated in the figure; however, these points were beyond 
the range of the engine simulation. The selected points are sea-level static; a tj^ical 
cruise condition, Mach 0. 8 at 9. 2-kilometer (30 000-ft) altitude; a flight condition at 
which the compressor face total pressure is high, Mach 1, 2 at 3. 0-kilometer (10 000- 
ft) altitude; a flight condition at which the compressor face total temperature is high, 
Mach 2. 2 at 15, 2-kilometer (50 000-ft) altitude; and a supersonic flight condition at 
which the compressor face pressure and temperature are nearly equal to the values for 
the subsonic cruise condition, Mach 1,2 at 12. 2-kilometer (40 000-ft) altitude. The 
values for the compressoii;, face variables and the correction factors for each flight con- 
dition are listed in the following table: 


Flight condition 

Compressor 
face total 
temperature, 
TT2 

Compressor 
face total 
pressure, 
PT2 

Temperature 

correction 

factor. 

Pressure 

correction 

factor, 

6 = PT2 
PSTD 

Mach 

number, 

M 

Altitude, 

h 

km 

ft 

K 


N/cm^ 

psi 

^ yxSTD 

(a) 

(a) 

(a) 

288 

519 

10. 1 

14.7 

1 

1 

. 8 

9.2 

30x10^ 

258 

465 

4.6 

6.7 

.95 

.45 

1.2 

3.0 

10 

346 

622 

16. 9 

24.5 

1. 10 


1.2 

12.2 

40 

279 

511 

4. 5 

6.6 

. 99 

.45 

2.2 

15.2 

50 

426 

767 

11. 2 

16. 3 

1.22 

1. 11 


^Sea-level static. 


The relations between the measured engine variables were obtained by first clearing 
the tables of any stored data and then using the self-learning feature of the sensor fail- 
operational digital computer program at each flight condition. The procedure involved 
running the simulated engine over the complete range of power lever angle for all pos- 
sible bleed settings and for both steady-state operation and engine acceleration. 

The data obtained in this manner were then compared. Examples of the relations 
between the measured engine variables are presented in figure 8. The examples show 
all six possible relations involving the four variables for steady-state operation and for 
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both bleeds being closed, except the Mach 2, 2, 15. 2-kilometer (50 000-ft) flight condi- 
tion, for which the seventh-stage bleed is open. It can be seen from this figure that 
there is little difference among the data for all the flight conditions, with the exception 
of sea-level static. The difference between the data at sea- level static and those at the 
other conditions is explained by the fact that the nozzle is unchoked at the sea-level 
static condition over most of its range. At the other flight conditions the nozzle is 
choked over most or all of its range of power lever angle. 

The difference in the data for these cases appeared to be significant enough to re- 
quire the storing of two sets of data: one for the choked nozzle, the other for the un- 
choked nozzle. The following test was included to determine the nozzle condition: If the 
ratio of ambient pressure to nozzle total pressure is greater than the critical value (PO/ 
PT7 > 0. 542), the nozzle is unchoked. Unchoked nozzle data were collected at sea-level 
static operation, and choked nozzle data were collected at the Mach 0. 8, 9. 2 -kilometer 
(30 000-ft) flight condition. The test for the nozzle condition also determines what set 
of data is to be used in estimating a value for any invalid measurement; but the test of 
the nozzle condition requires one of the measured engine variables, the nozzle total 
pressure. If this particular sensor should fail, there would be no way of determining 
which set of data should be used. An arbitrary decision was made to use the choked noz- 
zle data when the nozzle total pressure sensor was found to have failed. 

Figure 9 illustrates the effect twelfth-stage bleed has on the measured engine vari- 
able data. This particular example shows the steady-state relation between the corrected 
high-pressure-rotor speed and the corrected high-pressure-compressor discharge stat- 
ic pressure for the twelfth-stage bleed open and closed. Data are shown for two flight 
conditions: sea-level static; and Mach 0. 8, 9. 2-kilometer (30 000-ft) altitude. It can 
be seen that opening the twelfth-stage bleed has the effect of shifting both curves to the 
right; that is, the pressure associated with a particular rotor speed is higher with the 
bleed open. The difference between the two cases appears to be great enough to require 
storing both sets of data. 

Only one flight condition was examined for which the seventh-stage bleed was open: 
Mach 2. 2, 15, 2 kilometers (50 000 ft). At this flight condition, a lower limit on engine 
speed imposed by the control does not allow much variation in the measured engine var- 
iables. Over this small range, there appears to be no difference between the data col- 
lected with the seventh-stage bleed open and with it closed. This is illustrated in figure 
10 in which the steady-state relation between the corrected high-pressure-rotor speed 
and the corrected high-pressure-compressor discharge static pressure is presented. 

It seems that separate data for the two cases need not be collected. 

Separate data were also collected for steady-state operation and for operation when 
the fuel flow was limited by the acceleration schedule in the control. An example of 
the data for these two cases is shown in figure 11, It shows the relation between high- 
pressure-rotor speed and high-pressure-compressor discharge static pressure for both 
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steady-state operation and acceleration at two flight conditions: sea-level static; and 
Mach 0. 8, 9. 2-kilometer (30 000-ft) altitude. The difference between the data sets is 
small at the altitude condition. At sea-level static operation, the difference between 
the two sets of data is somewhat greater. 

The approach taken in this study was to collect data for all possible engine geom- 
etries and d 5 mamic conditions, as well as for both nozzle conditions, to obtain the best 
possible fail- operational control system. After this, the control system was tested 
using less complete data to determine just how much information is necessary to obtain 
acceptable results. 


Limits on Estimated Variables 

When a measured engine variable sensor has failed and the measured value is re- 
placed with an estimate obtained from the other measurements, there is a possibility 
that the estimated value may change the operation of the engine and hence the measure- 
ments that are used to estimate a value for the invalid measurement. This could re- 
sult in an unstable situation in some cases. Limits had to be put on the estimated values 
of two measured engine variables at the extreme values of power lever angle. A lower 
limit had to be placed on the estimated value of high- pressure- compressor discharge 
static pressure. When this variable is estimated low at a low value of power lever angle, 
the fuel flow, which is controlled by this pressure and the high-pressure-rotor speed, 
decreases. This causes a reduction in the measured variables used to estimate com- 
pressor pressure and hence a reduction in the estimated value of this variable. The 
process continues until the fuel flow stops altogether. This problem was encountered 
only at near- idle values of power lever angle and was solved by placing a lower limit on 
the estimated value of high- pressure- compressor discharge static pressure equal to the 
value that it normally would have at idle for the particular nozzle condition. 

It was also necessary to impose this lower limit on high-pressure-compressor dis- 
charge static pressure when the high-pressure-rotor-speed sensor failed at low values 
of power lever angle. If the speed is estimated high, the fuel flow decreases. This re- 
duces the actual speed and also the high-pressure-compressor discharge static pres- 
sure, which in turn tends to reduce fuel flow. The difference between the requested 
speed and the estimate of the actual speed tends to increase the fuel flow. But its effect 
is not sufficient to offset the reduction caused by the decreased value of high-pressure- 
compressor discharge static pressure. Consequently, the fuel flow continues to de- 
crease until the engine stops running. 

An upper limit on the estimated value of nozzle total pressure was necessary during 
afterburning operation, that is, when the power lever angle was above 69°. As men- 
tioned previously, this pressure determines the nozzle area and the afterburner- zone 


14 



fuel flows. If it is estimated high, the nozzle opens more than it should, decreasing 
the actual value of the nozzle total pressure. This tends to increase the low-pressure- 
rotor speed and the low-pressure-compressor discharge static pressure, which tends 
to further increase estimated nozzle total pressure. This process continues, causing 
abnormal nozzle and zone fuel-flow operation. The difficulty was corrected by limiting 
nozzle total pressure to the value that it has just before afterburning begins. This es- 
sentially eliminated nozzle total pressure as a control variable for the nozzle and zone 
fuel flows. The control function was fulfilled by the other variables; high- pressure - 
compressor discharge pressure and high-pressure-rotor speed. 

There might be a problem with this latter limit as the flight condition is changed 
while the engine remains in afterburning operation. This could be solved by changing 
the limit on nozzle pressure when the values of compressor face total temperature and 
pressure change by some specified amount, indicating a large change in flight condition. 

The nozzle pressure measurement is also used to detect afterburner light-off and 
blowout. If this particular measurement is being estimated from other engine measure- 
ments, errors in the estimate cause no serious operational limit violations during light- 
off. However, in the case of a blowout, the error in the estimated nozzle total pressure 
causes serious operational limit violations. Therefore, provision would have to be made 
to detect blowouts in some other manner. 


Engine Performance 

The unchoked nozzle data obtained at sea-level static condition and the choked noz- 
zle data obtained at the Mach 0. 8, 9. 2-kilometer (30 000-ft) flight condition were stored 
in the computer. Learning was then halted so that no additional data would be averaged 
with the original data. The sensor fail- operational control system was then tested at 
each of the five selected flight conditions. At each condition, all combinations of the 
four engine sensors (not including nozzle area) were failed, and the simulated engine was 
subjected to throttle variations from idle to military power (power lever angle from 15° 
to 69°) and from idle to full afterburning (power lever angle from 15° to 120°). Throttle 
variations were made both slowly, to simulate a series of steady-state operating points, 
and rapidly, to determine performance for throttle slams and chops. 

The effectiveness of the sensor fail- operational control system was judged by the 
following two criteria; First, it was necessary that none of the engine operating limits 
be exceeded; the surge margin of either of the two compressors or the fan may not be 
reduced; the turbine-inlet-temperature limit may not be exceeded; and the high- 
pressure-rotor-speed limit may not be exceeded. Second, it was desirable that the 
performance of the engine not be degraded; that is, that nearly the same thrust be ob- 
tained at a particular power lever angle and nearly the same thrust response result 
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from a change in power lever angle. 

The significant results were these: For nonafterburning operation (power lever ang- 
le less than 69 ), the simulated engine could be acceptably controlled with as many as 
three of the four engine sensors failed. One of the four variables, nozzle total pressure, 
does not affect operation when there is no afterburning; so its failure had no effect. 
Another variable, the low-pressure-compressor discharge static pressure, affects the 
twelfth-stage-bleed operation only. Results indicate that an acceptable value could be 
estimated for this variable from only one valid measurement. Acceptable values for the 
other two variables could also be obtained from only one valid measurement. For op- 
eration in the afterburning range (power lever angle from 69*^ to 120°), the engine could 
be acceptably controlled with no more than a single sensor failure, and then only if a 
modest, power-lever- angle rate limit is imposed (approx. 3 deg/sec). The low- 
pressure-compressor-discharge-static-pressure sensor could not be failed along with 
any of the other sensors even though it does not affect afterburning operation. Appar- 
ently, estimates based on this variable are needed to construct values for any invalid 
measurement. 

It is suspected that the limitation on failures in the afterburning range and the need 
for a power-lever- angle rate limit arise primarily from the use of an integrator loop 
(which eliminates steady-state error) in the afterburner control. This type of control is 
more sensitive to any difference between an estimated value for a variable and the true 
value it replaces. 

Even with only a single failure of one of the variables affecting afterburning opera- 
tion, the fifth- zone afterburner fuel flow in some cases was somewhat different from 
normal. The differences were not considered to be great enough to cause any difficulty. 

Acceptable control was defined earlier as not violating any of the engine operating 
limits and providing nearly the same thrust response. In order to illustrate a typical 
comparison between engine performance under sensor fail- operational control and nor- 
mal performance, a series of figures is presented for one particular single failure, that 
of a high-pressure-rotor-speed sensor. The assumed flight condition is Mach 1. 2 and 
3, 0-kilometer (10 000-ft) altitude. This flight condition was selected because the dif- 
ference between the pressure correction factor at this condition and that at which the 
data were learned is greater than that for any other flight conditions examined. Figure 
12 compares the loci of operating points for failed and normal performance on both the 
low-pressure- and high-pressure- compressor maps for steady-state operation and for 
a throttle slam from idle to full afterburning. Figure 13 compares high-pressure-rotor 
speed for failed and normal performance. For the failed case, both the actual speed 
and the estimated speed used by the control are presented. Figure 14 compares turbine 
inlet temperature for the two cases. The thrust obtained with a high-pressure-rotor- 
speed sensor failure is compared with normal thrust in figure 15. These figures indi- 
cate that the simulated engine performs fairly normally under sensor fail -ope rational 
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control with the high-pressure -rotor-speed sensor failure. 

A similar set of comparisons for a double failure is presented in figures 16 to 19, 

In this case, the two sensor failures are high- pressure- rotor speed and high- pressure- 
compressor discharge static pressure. The flight condition is again Mach 1. 2 and 3. 0- 
kilometer (10 000-ft) altitude. However, power lever angle is varied only from idle to 
military power. Failure of these two sensors means that main fuel flow must be con- 
trolled with only estimated values for the necessary variables. Again, these figures in- 
dicate that the simulated engine under sensor fail- operational control performs very 
nearly as it does normally. 


Operation with Reduced Data Storage 

Previous comparisons of the stored data for any particular flight condition reveal 
small differences between some of the curves. For example, the data for seventh- 
stage bleed open do not differ much from that for it closed (fig. 10), The sensor fail- 
operational program was again tested at the flight condition for which the seventh-stage 
bleed is open; Mach 2. 2 and 15, 2-kilometer (50 000-ft) altitude. This time, however, 
the data obtained when the seventh-stage bleed was closed were used. There appeared 
to be no difference in performance. , It is believed that data need not be collected for 
seventh- stage bleed open. This reduces the data storage requirement and simplifies the 
collecting of data. 

Operation of the sensor fail-operational control system with only one set of twelfth- 
stage-bleed data, either for the bleed open or closed, did not produce satisfactory per- 
formance. Apparently, the differences between the relations in the two cases are suf- 
ficiently great to require both sets of data to be stored. 

The data curves obtained during acceleration compare closely with the curves ob- 
tained for steady-state operation (fig. 11). Based on this observation the sensor fail- 
operational control system was tested by using the steady-state data to estimate values 
during acceleration. The performance of the simulated engine for this test was essen- 
tially the same as that obtained when the acceleration data were used. An example of 
this result is presented in figures 20 to 23. The case shown is for a throttle slam from 
idle to full afterburning with a high-pressure- rotor-speed sensor failure. The flight 
condition is again Mach 1. 2 and 3. 0-kilometer (10 000-ft) altitude. These figures com- 
pare the performance obtained with steady-state data and that obtained with acceleration 
data. Figure 20 compares the loci of operating points on both the low-pressure- and 
high-pressure-compressor maps; figure 21 compares the high-pressure-rotor speeds; 
figure 22, the turbine inlet temperatures; and figure 23, the thrust responses. Based 
on results of this type, it appears that separate acceleration data need not be collected. 

Even though there is a large difference between the data collected when the nozzle 
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is choked and when it is unchoked, the sensor fail-operational control system was tested 
using the unchoked data only (data collected at sea- level static operation). Surprisingly, 
for the most part the results were the same as those obtained with the two separate sets 
of data. In some cases, however, there was a slight reduction in high-pressure- 
compressor surge margin. It appears that it might be possible to collect data at sea- 
level static operation only. This would greatly simplify the collection of data if it is to 
be learned. The lower limit on high-pressure- compressor discharge static pressure 
had to be modified for this test. At any of the flight conditions other than sea-level 
static (i. e. , when the nozzle is choked), the lower limit on this pressure was set equal 
to the value it normally would have at idle at the respective flight conditions. This val- 
ue would either have to be learned or predetermined. 


Computer Requirements 

The sensor fail- operational digital computer program (exclusive of the stored data) 
requires about 2000 words of core storage. The complete set of stored engine data re- 
quires 4600 words of core storage. This latter requirement can be cut in half if accel- 
eration data are not stored and further reduced by 1/3 if data for open seventh-stage 
bleed are not stored. Also, the number could be reduced by using less than the 64 words 
for each data curve. Even with the 4600 words of data, the total storage requirement of 
the sensor fail-operational program is only 6600 words. This requirement, added to the 
5000-word requirement for the BOM control, comes to 11 600. With a 16 000-word- 
storage computer, over 4000 words would be available for other tasks. 

The computation time required by the sensor fail- operational digital computer pro- 
gram depends upon a number of factors. During learning (when no variable estimation 
is being done), the computation time depends upon the number of data points that are be- 
ing learned during that particular cycle. The maximum computation time observed dur- 
ing learning was about 13 milliseconds. During engine variable estimation (when no ad- 
ditional learning takes place), the computation time depends upon the number of meas- 
urements that must be estimated. The time is not directly proportional to the number 
of failures, however, because the number of table lookups (which require the most time) 
is not proportional to the number of failures. Estimation of a single variable requires 
about 3 milliseconds; both a double and a triple failure require about 4 milliseconds. As 
stated previously, a sampling interval of 25 milliseconds was selected for this study. 

The maximum time required by the sensor fail- operational digital computer program 
added to the 3 milliseconds required by the digital BOM control comes to 16 milliseconds. 
About 9 milliseconds of computation time would be available for other tasks. It is felt 
that with more efficient programming, computation time could be reduced considerably. 
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CONCLUSIONS 


The study indicates that a sensor fail- operational control system can be used to pro- 
vide acceptable control of a two-spool turbofan engine over a wide range of flight con- 
ditions with as many as three of the four engine sensors failed for nonafterburning en- 
gine operation. For afterburning operation, the sensor fail-operational system pro- 
vides acceptable control for only a single engine sensor failure. In this case, it is nec- 
essary that a slight limit be imposed upon engine acceleration. Because such an ex- 
treme range of compressor face conditions was investigated, the results obtained are 
applicable over a wide range of flight conditions. Further testing is required to ensure 
that results are applicable over the entire engine operating envelope. 

The sensor fail- operational control system was evaluated on a real-time, nonlinear, 
hybrid- computer simulation of a turbofan engine. The results of this study should be 
verified by using the system to control an actual engine. 

The engine variables were tested for catastrophic sensor failure only. The failure- 
detection part of the system could be expanded so that other types of failures can be 
handled. This is an area in which further work could be done. 

The Mach number measurement, which is received from the inlet control, was as- 
sumed to be always correct. In an integrated inlet and engine control system, it might 
be possible to handle a failure of this variable. 

Finally, it should be noted that this particular sensor fail-operational control sys- 
tem was designed to be "added on" to a digital representation of the basic bill-of- 
materials hydromechanical control system. Fail-operational requirements could have 
an effect upon the design of a completely new control system. Such a system may not 
have some of the limitations reported herein. 

Lewis Research Center, 

National Aeronautics and Space Administration, 

Cleveland, Ohio, July 30, 1975, 

505-05. 
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APPENDIX - SYMBOLS 


AJ 

AJC 

BL7 

BL12 

F 

h 

M 

N2 

N2/yr 

PLA 
PSTD 
PS 3 
PS 3/6 
PS4 
PS4/6 

PT2 

PT7 

PT7/6 

PO 

TSTD 

TT2 

T5 

t 

WF 

WFZn 

6 


2 2 

nozzle area, m (ft ) 

2 2 

commanded nozzle area, m (ft ) 
seventh- stage bleed 
twelfth- stage bleed 
net thrust, N (Ibf) 
altitude, km (ft) 

Mach number 

high-pressure-rotor speed, rpm 
corrected high-pressure-rotor speed, rpm 
power lever angle, deg 

2 

standard-day, sea-level pressure, 10. 1 N/cm (14.7 psi) 

2 

low-pressure-compressor discharge static pressure, N/cm (psi) 

2 

corrected low-pressure-compressor discharge static pressure, N/cm (psi) 

2 

high-pressure-compressor discharge (combustor) static pressure, N/cm (psi) 

corrected high-pressure-compressor discharge (combustor) static pressure, 
N/cm^ (psi) 

2 

compressor face total pressure, N/cm (psi) 

2 

nozzle total pressure, N/cm (psi) 

2 

corrected nozzle total pressure, N/cm (psi) 

2 

ambient pressure, N/cm (psi) 

standard-day, sea-level temperature, 288 K (519° R) 

compressor face total temperature, K (°R) 

turbine inlet temperature, K (°R) 

time, sec ' 

main fuel flow, kg/sec (Ibm/sec) 

zone n afterburner fuel flow (n = 1, . . . , 5), kg/sec (Ibm/sec) 

ratio of compressor face total pressure to standard-day sea-level pressure, 
PT2/PSTD 
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0 


ratio of compressor face total temperature to standard- day sea-level tem- 
perature, TT2/TSTD 

Engine station numbers (fig. 1): 

2 compressor face 

3 ■ low-pressure-compressor discharge 

4 high-pressure-compressor discharge 

5 turbine inlet 

7 nozzle 
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TABLE I. - variables USED FOR CONTROL OF TF30-P-3 ENGINE 


Variable 

Symbol 

Command input: power lever angle 

PLA 

Flight condition; 


Mach number 

M 

Ambient pressure 

PO 

Measured compressor face; 


Total temperature 

TT2 

Total pressure 

PT2 

Measured engine; 


High-pressure-rotor speed 

N2 

High-pressure-compressor discharge static pressure 

PS4 

Low-pressure-compressor discharge static pressure 

PS 3 

Nozzle total pressure 

PT7 

Nozzle area 

AJ 

Manipulated; 


Main fuel flow 

WF 

Seventh-stage bleed 

BL7 

Twelfth-stage bleed 

BL12 

Nozzle area 

AJC 

Afterburner fuel flow: 


Zone 1 

WFZl 

Zone 2 

WFZ2 

Zone 3 

WFZ3 

Zone 4 

WFZ4 

Zone 5 

WFZ5 

Controlled; net thrust 

F 




TABLE n. - DIGITAL SYSTEM CAPABILITIES 


Digital computer 

Magnetic core memory size, words 

16 384 

Word length, bits plus parity 

16 

Memory cycle time, nsec 

750 

Add time, /nsec 

1. 5 

Subtract time, tisec 

1. 5 

Multiply time, /nsec 

4. 5 

Divide time, jisec 

8.25 

Load time, /nsec 

1.5 

Store time, /nsec 

1. 5 

Indirect addressing 

Infinite 

Indexing 

Total memory 

Priority interrupts 
Index registers: 

28 Separate levels 

Independent 

1 

In conjunction with lower accumulator 
Physical size, in. : 

1 

Width 

24 

Height 

62 

Depth 

30 

Interval timers 

Complement 

2 

Accuracy, clock pulses 

±1 

Clock rates, kHz 

572, 286, 160, 143, 80, 71. 5. 

40, 35, 75, 20, 10 

Counter 

16- Bit binary 

Output 

Priority interrupt to computer 

Analog acquisition unit 

Overall sample rate (maximum), kHz 

20 

Resolution of digital data, bits 

12 (plus sign) 

Output code 

Two's complement 

Number of channels 

64 

Input range, V full scale 

±10 

Input impedance, MSI (shunted by 10 pF) 

10 

Maximum source resistance, S2 

1000 

Conversion time, /usec 

38 

Input setting time, /usec 

9 

Sample- and-hold aperture time, nsec 

500 

Safe input voltages, V 

±20 sustained 
±100 for less than 100 /usee 

Total error with calibration, percent 

0.073 




TABLE n. - Concluded, 


Frequency acquisition unit 

Number of channels 

10 

Nature of input 

Continuously varying or pulsatile 

Resolution of digital data, bits 

12 

Switch selectable clock rates, kHz 

20, 80, 100, 400, external 

Overall accuracy, bits 

±1 

Update rate 

Once per cycle of input frequency 

Maximum input frequency, kHz 

1 

Input amplitude range 

100 mV to 30 V peak to peak 

Analog output unit 

Total number of digital-to- analog 

26 

conversion channels 


Resolution (10 channels), bits 

12 (plus sign) 

Resolution (16 channels), bits 

1 1 (plus sign) 

Output voltage range, V full scale 

±10 

Output current (maximum), mA 

10 

Output impedance, 0 

<1 

Accuracy (12 bit), percent of full scale 

±0. 1 

Accuracy (13 bit), percent of full scale 

±0.05 

Slew rate, V//isec 

1 

Settling time for 10-V step to within 0.05 

20 

percent of final value, jxsec 


Logical output unit 

Number of electronic switch outputs 

32 

Number of contact closure outputs 

32 

Maximum voltage, V 

30 

Maximum current, mA 

100 

Priority interrupt processor 

Number of channels 

10 

Input impedance, kS2 

47 

Input voltage range, V 

±10 

Comparator switching 

Trigger on rise or fall 

Comparator hysteresis 

Adjustable from 35 mV to 650 mV 

Comparator output, V 

±7 

Monostable multivibrator; 

.3 

Ihilse width, /usee 

±7 

Pulse height, V 





TABLE m. - TABLES OF STORED, MEASURED ENGINE VARIABLES 


Table 

Data 

Units 

Independent variable 

Range 

Increment 

N/cm^ 

psi 

N/cm^ 

psi 

1 

N2/y^ against PT7/6 

A 

rpm, N/cm (psl) 

10. 3-29.0 

15 - 42 

0, 34 

0. 50 

2 

N2|^ against PS4/6 

rpm, N/cm^ (psi) 

20. 7 - 207 

30 - 300 

3.4 

5.0 

3 

N2y0 against PS 3/5 

rpm, N/cm^ (psi) 

0 - 74. 5 

0 - 108 

1.4 

2.0 

'4 

PS4/5 against PT7/6 

N/cm^ (psi) 

10. 3 - 29. 0 

15 - 42 

.34 

. 50 

5 

PS3/6 against PT7/6 

N/cm^ (psi) 

10. 3-29.0 

15 - 42 

. 34 

. 50 

6 

PS3/6 against PS4/6 

N/cm^ (psi) 

20.7 - 207 

30 - 300 

3.4 

5.0 





CO 

CO 

a? 

cz 

CO 

c 

LU 


Figure 1. - Schematic representation of TF30-P-3 afterburning turbofan engine with station designations. 




Figure 2. - Engine operating limits for TF30-P-3 engine. 
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Figure 3. - Split of TF30-P-3 simulation computational load. 


28 



•Command input 



Process-control-type 
digital computer 
(16 000-word memory) 


Three analog consoles' 
Digital computer 
(15 OOO-word memory) 


Figure 4. - System used in evaluating sensor fail-operational system. 



Corrected airflow 

Figure 5. - Schematic representation of a corrected compressor map. 
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(b) Sensor fail-operational control system. 

Figure 6. - Comparison of a conventional engine control system with a sensor fail-operational control system. 
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Corrected high-pressure-compressor discharge static 
pressure, PS4/6, N/cm^ 


Corrected high-pressure-compressor discharge 
static pressure, PS4/6, N/cm^ 


Figure 9. - Effect of twelfth-stage-bleed condition on measured 
engine variable data for two flight conditions. Steady-state 
operation; seventh-stage bleed closed. (Data from table 2. ) 
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Corrected high-pressure-compressor discharge 
static pressure, PS4/6, psi 


Figure 10. - Effect of seventh-stage-bleed condition 
on measured engine variable data at Mach 2. 2, 

15. 2-km (50 OOD-ft) flight condition. Steady- 
state operation; twelfth-stage bleed closed. (Data 
from table 2). 
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Figure 11. - Comparison of steady-state data with data obtained 
during engine acceleration for two flight conditions. Both 
twelfth-stage and seventh-stage bleeds closed. (Data from 
table 2. 1 
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(a) Acceleration and deceleration. 
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(b) Steady state. 

Figure 13. - High-pressure-rotor speed for normal operation and for a high-pressure-rotor-speed sensor 
failure. Flight condition, Mach 1.2and3.0-km tlOOOO-ft) altitude; data obtained at Mach O.Sand 
9. 2-km (30 000-ft) altitude. 
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(b) Steady state. 


Figure 14. - Turbine inlet temperature for normal operation and for a high-pressure-rotor-speed sensor failure. 
Flight condition, Mach 1. 2 and 3. 0-km (10 000-ft) altitude; data obtained at Mach 0. 8 and 9. 2-km (30 000-ft) 
altitude. 
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Figure 15. - Net thrust for normal operation and for a high-pressure-rotor-speed sensor failure. Flight condition, 
Mach 1. 2 and 3. 0-km (10 000-ft) altitude; data obtained at Mach 0. 8 and 9. 2-km (30 000-ft) altitude. 
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Figure 18. -Turbine inlet temperature for normal operation and for failure of the high-pressure-rotor-speed and high-pressure- 
compressor-discharge-static-pressure sensors. Flight condition. Mach 1. 2 and 3. 0-km (10 000-ft) altitude; data obtained at 
Mach 0. 8 and 9. 2-km (30 000-ft) altitude. 
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Figure 19. - Net thrust for normal operation and for failure of the high-pressure-rotor-speed and high-pressure-compressor- 
discharge-static-pressure sensors. Flight condition, Mach 1. 2 and 3. 0-km (10 000-ft) altitude; data obtained at Mach 0.8 
and 9. 2-km (30 000-ft) altitude. 
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Figure 21. - High-pressure-rotor speed for a throttle slam with a high-pressure-rotor-speed sensor failure 
for the case in which acceleration data are used and for the case in which steady-state data are used. 

Flight condition, Mach 1. 2 and 3. 0-km (10 000-ft) altitude; data obtained at Mach 0. 8 and 9. 2-km (30 000-ft) 
altitude. 
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Figure 22. -Turbine iniet temperature for a throttle slam with a high-pressure-rotor-speed sensor failure for the 
case in which acceleration data are used and for the case in which steady-state data are used. Flight condition, 
Mach 1. 2 and 3. 0-km (10 000-ft) altitude; data obtained at Mach 0.8 and 9. 2-km (30 000-ft) altitude. 
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Figure 23. - Net thrust for a throttle slam with a high-pressure-rotor-speed sensor failure for the case in which 
acceleration data are used and for the case in which steady-state data are used. Flight condition, Mach 1. 2 
and3.0-km (10 000-ft) altitude; data obtained at Mach 0.8 and 9. 2-km (30 000-ft) altitude. 
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